The Linux kernel's brcmfmac WiFi driver had a vulnerability where the bus_reset work callback could be scheduled or running during device removal, potentially accessing freed driver memory (use-after-free). The removal path freed the driver structure without draining the pending or running bus_reset work, causing a race condition. The fix adds a per-bus mutex to serialize scheduling and cancellation of bus_reset work, ensuring that work is cancelled and drained before driver removal proceeds. This prevents the callback from outliving the driver structure. The patch also guards against NULL dereferences in brcmf_fw_crashed() and applies the fix across PCIe, SDIO, and USB bus types. The issue was found via static analysis and does not address a separate asynchronous firmware completion lifetime issue.

The vulnerability could lead to use-after-free conditions in the brcmfmac WiFi driver, potentially causing kernel crashes or memory corruption. No active exploits are known. The impact is limited to affected Linux kernel WiFi driver code paths involving device removal and bus reset handling.

A fix has been implemented in the Linux kernel to properly synchronize and cancel bus_reset work during device removal, preventing use-after-free. Users should update to a Linux kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation. No additional mitigation is indicated by the vendor advisory.